@exodus/ethereum-lib 5.24.2 → 5.24.3

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.24.3](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-lib@5.24.2...@exodus/ethereum-lib@5.24.3) (2026-06-11)
+
+
+### Bug Fixes
+
+
+* fix: Ledger clear-signing for EVM token approvals (#8207)
+
+
+
 ## [5.24.2](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-lib@5.24.1...@exodus/ethereum-lib@5.24.2) (2026-05-13)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/ethereum-lib",
-  "version": "5.24.2",
+  "version": "5.24.3",
   "description": "Ethereum utils, such as for cryptography, address encoding/decoding, transaction building, etc.",
   "type": "module",
   "main": "src/index.js",
@@ -23,13 +23,13 @@
   },
   "dependencies": {
     "@exodus/basic-utils": "^3.0.1",
+    "@exodus/bytes": "^1.0.0-rc.5",
     "@exodus/crypto": "^1.0.0-rc.18",
     "@exodus/currency": "^6.0.1",
     "@exodus/ethereumjs": "^1.6.0",
     "@exodus/key-utils": "^3.7.0",
     "@exodus/models": "^13.0.0",
     "@exodus/solidity-contract": "^1.1.3",
-    "base-x": "^3.0.2",
     "lodash": "^4.17.15",
     "minimalistic-assert": "^1.0.1",
     "ms": "^2.1.1",
@@ -51,5 +51,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "8cf5e6a5fc7d235c2c57ea51219bb1e3469329c5"
+  "gitHead": "f9bb7fcf58132b8daa6db82edc0bc53f380029cd"
 }

package/src/unsigned-tx/create-unsigned-tx.js

@@ -48,11 +48,7 @@ export default function createUnsignedTxFactory({ chainId }) {
 
     const _isToken = isToken(asset)
     const to = _isToken ? asset.contract.address : address
-    let value = currency2buffer(txValue)
-
-    // TODO: check: present on desktop missing on mobile. This insures we never have a buffer specifying 0.
-    // In ETH, a buffer of zero length and a buffer specifying 0 imply different things
-    if (value.equals(Buffer.from([0]))) value = Buffer.alloc(0)
+    const value = currency2buffer(txValue)
 
     assert(fromAddress, 'createTx: fromAddress is requied')
 

package/src/unsigned-tx/sign-hardware.js

@@ -2,16 +2,31 @@ import assert from 'minimalistic-assert'
 
 import createEthereumJsTx from './create-ethereumjs-tx.js'
 
+// Resolves the Ledger `isNft` clear-signing hint for the contract this tx calls.
+// Delegates the on-chain ERC-165 classification to the injected `getIsNft`; stays
+// undefined when there's no contract method call to classify. The hint only drives
+// the device's display resolution and never affects the signed bytes.
+const resolveIsNft = async ({ tx, getIsNft }) => {
+  // Only txs with a target and calldata can be token/NFT operations; a plain
+  // value transfer has nothing for the device to clear-sign as one.
+  if (!tx.to || !tx.data?.length || typeof getIsNft !== 'function') return
+
+  return getIsNft({ address: tx.to.toString().toLowerCase() })
+}
+
 export const signHardwareFactory =
-  ({ baseAssetName }) =>
+  ({ baseAssetName, getIsNft }) =>
   async ({ unsignedTx, hardwareDevice, accountIndex }) => {
     const tx = createEthereumJsTx(unsignedTx)
 
+    const isNft = await resolveIsNft({ tx, getIsNft })
+
     const signedTx = await signWithHardwareWallet({
       baseAssetName,
       tx,
       hardwareDevice,
       accountIndex,
+      isNft,
     })
 
     // serialize and get txId
@@ -20,12 +35,13 @@ export const signHardwareFactory =
     return { rawTx, txId }
   }
 
-async function signWithHardwareWallet({ baseAssetName, tx, hardwareDevice, accountIndex }) {
+async function signWithHardwareWallet({ baseAssetName, tx, hardwareDevice, accountIndex, isNft }) {
   const rlpEncodedTx = tx.serialize()
   const signatures = await hardwareDevice.signTransaction({
     assetName: baseAssetName,
     signableTransaction: rlpEncodedTx,
     derivationPaths: [`m/44'/60'/${accountIndex}'/0/0`],
+    isNft,
   })
 
   const { signature } = signatures[0]

package/src/utils/index.js

@@ -1,12 +1,9 @@
+import { fromHex, toHex } from '@exodus/bytes/hex.js'
 import { FeeMarketEIP1559Transaction, Transaction } from '@exodus/ethereumjs/tx'
 import { padToEven, toBuffer } from '@exodus/ethereumjs/util'
-import baseX from 'base-x'
 
 export { default as calculateExtraEth } from './calculate-extra-eth.js'
 
-const base10 = baseX('0123456789')
-const base16 = baseX('0123456789abcdef')
-
 /* @deprecated */
 export const isEthereumToken = (asset) => asset.assetType === 'ETHEREUM_ERC20'
 /* @deprecated */
@@ -54,21 +51,28 @@ export const isEthereumLikeByName = (assetName) => {
 }
 
 export function buffer2currency({ asset, value }) {
-  return asset.currency.baseUnit(base10.encode(value))
+  if (value.length === 0) return asset.currency.ZERO
+
+  return asset.currency.baseUnit(`0x${toHex(value)}`)
 }
 
 export function currency2buffer(value) {
-  const b10Value = value.toBaseString()
+  // In RLP, a big-endian interpretation of 0 consists of zeros -
+  // so after trimming, we should yield empty byte array.
+  //
+  // https://ethereum.stackexchange.com/a/61021
+  if (value.isZero) return Buffer.alloc(0)
 
-  // Desktop: const hexValue = new BN(value.toBaseString()).toString(16)
-  const hexValue = base16.encode(base10.decode(b10Value))
-
-  if (hexValue.includes('.')) {
-    // <-- probably not necessary anymore
-    throw new RangeError(`${value.toBaseString()} can not be converted to Buffer`)
+  const b10Value = value.toBaseString()
+  if (b10Value[0] === '-') throw new RangeError('Negative numbers can not be converted to Buffer')
+  if (b10Value.length > 1 && b10Value[0] === '0') {
+    // Number is not supposed to be telling us the width, we always convert to smallest buffer that fits it
+    throw new RangeError('Padded numbers can not be converted to Buffer')
   }
 
-  return Buffer.from(padToEven(hexValue), 'hex')
+  // Desktop: const hexValue = new BN(value.toBaseString()).toString(16)
+  const hexValue = BigInt(b10Value).toString(16)
+  return fromHex(padToEven(hexValue), 'buffer')
 }
 
 export function normalizeTxId(txId) {